The sneaky shift: Adversaries are simply bypassing defensesThe sneaky shift: Adversaries are simply bypassing defenses

In financially motivated communities, adversaries share ideas, tools, and services that make bots look and act like real users. The result? A supply chain that helps threats evolve to quickly evade detection.

Cheap. Accessible. Effective. Attackers have a lot of tricks. To bypass defenses and evade detection, adversaries employ an array of techniques that defeats traditional bot management tools. Easy to find. Easy to use. Hard to defeat — with outdated “solutions.”

Some threat actors have realized the real business is in attacking the bot management solutions, not your applications directly. Like a SaaS vendor, they build and sell “solver services” that help fellow adversaries appear human and easily bypass bot defenses. This means there are quickly accessible bypasses for most bot management vendors — you can even find them using Google!

1. An attacker sets up a solver service for a specific bot management defense
2. Other, less resourceful attackers exchange money for human bypass tokens
3. Bot traffic disguised as human traffic bypasses anti-bot defense

Basic detections of the client environment are no longer effective. Attackers use highly customized versions of open-source DevTools like Puppeteer (with the Extra Stealth plugin) to appear as a legitimate client.

1. Attacker uses fully automated environments with human-like behavior to bypass defenses

Traditional detections like IP reputation and IP-based rate limiting are no longer effective, thanks to services that cheaply allow attackers to proxy their traffic through millions of legitimate consumer IP addresses. Free VPNs often secretly act as exit nodes on unsuspecting real users, providing cover for attackers.

1. Attacker subscribes to a residential proxy network service
2. IP-based defenses bypassed by hiding in legitimate IPs from all over the world

CAPTCHAs are ineffective and frustrate users. Attackers cheaply bypass them by using a combination of AI/ML, human farms, and reverse engineering — services that are, once again, easily findable through Google. The only things that benefit from CAPTCHAs are the bots who now appear human, thanks to “successful solves.”

1. Attacker extracts unsolved CAPTCHA from the anti-bot solution
2. Attacker pays CAPTCHA bypass service to solve the CAPTCHA
3. Bot bypasses anti-bot defenses with solved CAPTCHA

Machine learning-based detection can sound promising, but often doesn’t hold up against adversaries that know how to fool it. By customizing their tooling, attackers can feed ML-based detections statistically accurate (but fake) data, which appears human.

1. Bot confuses the machine learning model by overloading it with fake information
2. Machine learning defenses are bypassed by hiding amongst the noise

Bot Management often uses obfuscated code to hide how bot detection works. Most solutions rely on open-source tools with well-known vulnerabilities to de-obfuscation. Once an attacker understands exactly how your defenses work, they are effectively useless.

1. Attacker obtains detection script
2. Attacker reverse engineers script and learns the data needed to classify as human
3. Bot bypasses the anti-bot solution by providing it with fake data